This vulnerability affects Oracle Hyperion Financial Management component Security in version 11.2.25.0.000. It allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized ability to read, update, insert, or delete some accessible data and cause partial denial of service. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data, and partial denial of service affecting Oracle Hyperion Financial Management. The confidentiality, integrity, and availability impacts are limited but significant enough to warrant attention.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability documentation should be consulted for installation instructions. No indication of temporary or alternative mitigations is provided, so patching is the recommended course of action.